The present invention relates generally to security procedures for a computer processing environment, and more specifically to analyzing and determining a present security vulnerability level for the computer processing environment based on a collection of security values for different operational aspects.
As existing processing systems increase in complexity, security is always a paramount concern. From even the early development of computing environments, security features have been included. Earlier security features includes simple procedures such as login identifiers and passwords and have since evolved to varying levels, including techniques such as public and private key encryption.
Existing security systems typically focus on a particular component of the processing environment. This can be problematic due to the varying amounts of components or operating aspects. For example, in an enterprise management software application, there are numerous layers of processing operations, data storage and user interaction. A security technique for one layer may not have any affect or benefits to the other layers.
By way of example, an enterprise resource planning (ERP) application may include a large database of information usable by processing routine on an application layer. Various security protocols and operations may be included in the interface layer to prevent unauthorized access to the data through the applications, for example verifying user authenticity when the user logs into the system. The ERP system may also include data integrity or batch processing operations to monitor the data itself to insure there are no unauthorized access of data through other means outside of the interface layer. The ERP system may also include accessibility protocols defining various levels of user authorization to data and preventing any unauthorized data access, such as someone with a low security clearance accessing highly confidential or otherwise sensitive information.
The present approach to system security is a piecemeal technique that examines each of the various aspects of the system. This piecemeal technique fails to provide a global security synopsis of the full operating system. Under existing techniques, the security of the data in the database can determined, the ability to breach the security of the user interface can be determined and other security aspects are individually determined. These disparate determinations do not provide a collective indication of existing system security. Therefore, under existing techniques, an end user must actively monitor each of these various components in the hopes that no single component becomes the weakest link in the security chain. Additionally, the end user is unable to have a reliable metric for determining complete system security, but rather can only obtain knowledge as to the security of each individual component.
In addition, the present disparate security vulnerability determination technique complicates system development. As there is no present technique for analyzing a system-wide security level, designers and system developers cannot improve system designs in a holistic fashion, but rather address the components individually. As these varying layers in the processing environment are intricately interrelated, changes in the different components can have unintended security consequences for the other components, further complicating the design process.
Currently, there are several known security development techniques. One existing technique is commonly known as the System Security Engineering Capability Maturity Model technique, also referred to by the acronym SSE-CMM. This engineering technique is a tool for evaluating security engineering practices and defining improvements to the evaluated practices. Another development technique is DMAIC, which is part of the Six Sigma development technique. DMAIN is a data-driven quality strategy for improving varying processing operations and refers to Define, Measure, Analyze, Improve and Control.
Similar to the current limitations found in existing computing systems, these security and system development tools are not presently applicable to full computing systems. Existing systems, including development and refinement procedures can focus on the individual processing components but fail to address the processing system as a whole. Therefore, there exists a need, among other solutions, for operations and techniques to evaluate security levels of a processing environment and allow for design adjustments and improvements therein.